fix: post-merge CI feedback from #22 — deprecated APIs, workflow timeouts

[hyperpolymath]

Small follow-up addressing the CI feedback that arrived on #22 after merge:

• ui: replace deprecated Js.Dict.t / Js.Nullable with RescriptCore Dict.t / Nullable in WasmStore.res and Persist.res — resolves Hypatia code-scanning alerts 143 and 144. Same runtime representation; ReScript compiles clean and all deno test suites pass.
• ci: add timeout-minutes to the rust-ci and ui-ci jobs (Hypatia workflow_audit: missing_timeout_minutes). Only the two workflows introduced in Web-first resurrection: UI builds and runs on the WASM Rust core, real CI, docs truth reset #22 are touched; the estate workflows' findings are left to estate propagation.

Deliberately not addressed here (estate-level decisions, pre-existing on main):

• governance / Language / package anti-pattern policy — the standards HEAD now bans ReScript in favour of AffineScript; every existing .res file trips it and the AffineScript compiler isn't available outside the estate. The check's own remediation path is a .hypatia-baseline.json / .hypatia-ignore exemption — happy to add a grandfathering entry if that's the desired policy call.
• governance / Check Workflow Staleness — flags scorecard.yml uploading SARIF without running per-PR; scorecard.yml is estate-canonical and untouched by this branch.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PAEqVP7Y3bZDhtAaPUTbps

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🔍 Hypatia Security Scan

Findings: 61 issues detected

Severity	Count
🔴 Critical	1
🟠 High	24
🟡 Medium	36

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in hypatia-scan.yml",
    "type": "missing_timeout_minutes",
    "file": "hypatia-scan.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence